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IN THE CLAIMS 
Please amend the claims as follows: 

1 . (Original) A method to diagnose a problem from multiple events in a system of managed 
components generating real-time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

2. (Original) The method of claim 1, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fi-agments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

3. (Original) The method of claim 2, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

4. (Original) The method of claim 3, wherein the system comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 
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5. (Original) The method of claim 3, wherein the events comprise: 
exceptional conditions occurring in the operation of the netw^ork. 

6. (Currently Amended) The method of claim 5, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware[[/n failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

7. (Original) The method of claim 6, wherein determining the event nodes comprises: 
determining the event nodes from a database defining the network managed objects and 

event notifications that convey the state of one or more managed objects. 

8. (Original) The method of claim 7, wherein determining the event nodes further 

comprises: 

determining the event nodes from expert knowledge of the network. 

9. (Original) The method of claim 8, wherein the managed objects comprise: 
objects selected from the group consisting of network objects, attached systems, and 

application objects. 

10. (Currently Amended) The method of claim 8, wherein the database comprises: 

static information associated with each class of managed [[and/]]or dynamic information 
that affects the causal propagation of events. 

1 1 . (Original) The method of claim 3, wherein sampling the incoming real-time events 
comprises: 

sampling the incoming real-time events sequentially in the order they are received. 

12. (Original) The method of claim 3, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 

I 
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13. (Original) The method of claim 12, wherein the abstract exception condition comprises: 
abstract exception conditions selected from the group consisting of a notion of fault and a 

notion of performance degradation, a network card in a communication system being faulty with 
the number of users being served by the communication system drastically reducing, and link 
between two routers going down leading to the use of alternate paths which lead to congestion 
and performance. 

14. (Original) The method of claim 12, wherein capturing the abstract exception condition 
comprises: 

capturing normal paths based on predetermined criteria on which the events have to be 
diagnosed. 

15. (Original) The method of claim 14, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

16. (Original) The method of claim 1, wherein forming the FCM, comprises: 
capturing system event interdependencies. 

17. (Original) The method of claim 15, wherein capturing the system event 
interdependencies comprises: 

interconnecting event and concept nodes using interdependency arcs capturing temporal 
and logical dependencies. 

18. (Original) The method of claim 17, wherein the interdependency arcs comprise: 
weights based on temporal and logical dependencies. 

19. (Original) The method of claim 3, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 
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computing an indirect effect of events {predictive event-correlation) on concept nodes 
using the equations; 

Ipx(Ei, Q) = min( (E, Cj)) = inm( ^ (E, E^)) 0 © min( q^^^ {E^, Q)) 

wherein the indirect effect of events Ei on concept nodes Ci can be defined as the 
intersection of the linked causal types and can be described by the above equation, is a 

function which takes lij to [0,1] in path 'p' i.e. ciy = f (lij, ^ij ), e {0,1}, and © represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

^,(///^),//^W) = max{0,^^W + ^^W-l} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions ha and 

Mb. 

20. (Original) The method of claim 19, wherein mapping the received real-time events to the 
formed FCM fragments comprises: 

correlating the received events to the identified concept nodes to evaluate the effect of the 
received event nodes on the identified concept nodes using the determined element 
interdependencies. 

21 . (Original) The method of claim 20, wherein correlating the received events to the 
concept nodes further comprises: 

accumulating evidence based on the received event nodes; 
comparing the accumulated evidence to a threshold value; and 

analyzing the concept nodes based on the outcome of the comparing to evaluate the effect 
of the received event nodes. 
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22. (Original) A method for diagnosing problems from multiple events in a communication 
network including managed components generating real-time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 

using network element interdependencies; 

sampling generated incoming real-time events from the network; and 

diagnosing each of the generated problems by mapping the received sampled events to 

the formed FCM fragments. 

23. (Original) The method of claim 22, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

24. (Original) The method of claim 23, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the foraied FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

25. (Original) A computer readable medium having computer-executable instructions to 
diagnose problems from multiple events in a system of managed components generating real- 
time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 
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26. (Original) The computer readable medium of claim 25, w^herein forming the FCM 
fragments comprises: 

determining event nodes from events in the database; 
identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

27. (Currently Amended) The computer readable medium of claim 26, w^herein diagnosing 
the sampled events comprises: 

mapping the sampled real-time events to the formed FCM fragments including 
determined event nodes to_evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on activation levels of the 
concept nodes; and 

diagnosing the problems based on the outcome of the analysis. 

28. (Original) The computer readable medium of claim 27, wherein the system comprises: 
a system selected from the group consisting of explicit system, implicit system, 

centralized system, partially centralized system, and distributed system. 

29. (Original) The computer readable medium of claim 28, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

30. (Currently Amended) The computer readable mediimi of claim 29, wherein the event 
nodes comprise: 

significant events selected from the group consisting of hardware[[/]] failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 
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3 1 . (Original) The computer readable medium of claim 27, wherein identifying the concept 
nodes comprises: 

identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 

32. (Original) The computer readable medium of claim 27, wherein evaluating the effect of 
the received event nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 
Ip,(Ei,CO = min(g (Ei,Cj)) = niin(g (Ei,EO)© ®min(e (Ek„,Cj)) 

wherein the indirect effect of events Ej on concept nodes Q can be defined as the 
intersection of the linked causal types and can be described by the above equation, is a 

function which takes ly to [0,1] in path 'p' i.e. enj = f ^ (lij, ^lij ), Hij € {0,1}, and 0 represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a ^bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U ( //^ (^). //^ (^)) = {0' //^ (^) + //^ (^) - 1} 

wherein tiQ is a t-norm between fuzzy sets A and B with membership functions and 

33. (Original) A computer system to diagnose problems from multiple events in a system of 
managed components generating real-time events of problems, comprising: 

a storage device; 
an output device; and 

a processor programmed to repeatedly perform a method, comprising: 
forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
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sampling generated incoming real-time events from the system; and 

diagnosing problems by mapping the sampled events to the formed FCM fragments. 

34. (Original) The system of claim 33, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

35. (Original) The system of claim 34, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes evaluate the effect of the mapped event nodes on the identified concept 
nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

36. (Original) The system of claim 35, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

37. (Currently Amended) The system of claim 35, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware[[/]] failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

38. (Original) The system of claim 35, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 
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39. (Original) The system of claim 35, wherein forming the FCM, comprises: 
capturing system event interdependencies by interconnecting event and concept nodes 

using interdependency arcs that capture temporal and logical dependencies. 

40. (Original) The system of claim 35, v^herein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 
Ip,(Ei,Q) = min(g (Ei,Cj)) = min(g (Ei,Ek))e ®niin(g (Ekn, Cj)) 

wherein the indirect effect of events Ei on concept nodes Ci can be defined as the 
intersection of the link causal types and can be described by the above equation, is a 

function which takes ly to [0,1] in path 'p' i.e. enj = f -> (ly, ^ij ), |iij e {0,1}, and 0 represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

UilJLyXfd^ (^)) = max {0, fA^ (x) + jj^^ (x) - 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions ^a and 

Mb. 

41 . (Original) An event-correlation system to diagnose problems from multiple incoming 
real-time events in a communication network of managed components generating real-time 
events of problems, comprising: 

an event-analyzer to form fuzzy cognitive map (FCM) fragments using network element 
interdependencies derived from a database defining the network managed objects and event 
notifications that convey the state of one or more managed objects; and 

an event-processing module coupled to the event-analyzer to sample generated incoming 
real-time events from the network, wherein the analyzer to diagnose the problems from the 
sampled events by mapping the sampled events to the formed FCM fragments. 
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42. (Original) The event-correlation system of claim 41, wherein the analyzer forms 
FCM fragments by determining event nodes from events in the database, and by further 
identifying concept nodes from the determined event nodes to form FCM fragments including 
interdependencies between the identified concept nodes and the determined event nodes. 

43. (Original) The event-correlation system of claim 41, wherein the analyzer further 
maps the sampled events to the formed FCM fragments including determined event nodes to 
evaluate the effect of the mapped events on the determined concept nodes using the determined 
interdependencies, wherein the analyzer identifies the problems by analyzing the concept nodes 
based on the outcome of the evaluation and further diagnoses the problems based on the outcome 
of the analysis. 

44. (Original) The event-correlation system of claim 43, wherein the communication 
network comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 

45. (Original) The event-correlation system of claim 43, wherein the events 
comprise: 

exceptional conditions occurring during operation of the network. 

46. (Currently Amended) The event-correlation system of claim 45, wherein the 
event nodes comprise: 

significant events selected from the group consisting of hardware[[/11 failures, 
software failures, performance bottlenecks, configuration problems, and security violations. 

47. (Original) The event-correlation system of claim 46, wherein the analyzer 
determines the event nodes from a database defining the network managed- objects and event 
notifications that convey the state of one or more managed objects. 
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48. (Original) The event-correlation system of claim 47, wherein the analyzer 
determines the event nodes from expert knowledge of the network. 

49. (Original) The event-correlation system of claim 48, wherein the managed 
objects comprise: 

objects selected from the group consisting of network objects, attached systems, 
and application objects. 

50. (Currently Amended) The event-correlation system of claim 48, wherein the 
database comprises: 

static information associated with each class of managed objects [[and/]]or 
dynamic information that affects the causal propagation of events. 

5 1 . (Original) The event-correlation system of claim 43, further comprising: 

a communication interface module coupled between the network and the event- 
processing module to extract events from real-time messages received in different formats from 
the network and to further sample the extracted events sequentially in the order they are received. 

52. (Original) The event-correlation system of claim 43, wherein the analyzer 
identifying the concept nodes comprises a composite set of events that capture a notion of an 
abstract exception condition in the network. 

53. (Original) The event-correlation system of claim 52, wherein the abstract 
exception condition comprises conditions selected from the group consisting of a notion of fault 
and a notion of performance degradation. 

54. (Original) The event-correlation system of claim 52, wherein the analyzer 
captures the abstract exception condition by capturing normal paths based on predetermined 
criteria from which for the events are diagnosed. 
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55. (Original) The event-correlation system of claim 54, wherein the criteria 
comprises: 

causal and temporal inconsistencies between events. 

56. (Original) The event-correlation system of claim 43, wherein the analyzer forms 
FCM by capturing system event interdependencies. 

57. (Original) The event-correlation system of claim 56, wherein the analyzer 
captures system interdependencies by interconnecting event and concept nodes using 
interdependency arcs to capture temporal and logical dependencies. 

58. (Currently Amended) The event-correlation system of claim 57, wherein the 
interdependency arcs comprise: 

weights based on temporal and logical dependencies. 

59. (Original) The event-correlation system of claim 43, wherein the analyzer 
evaluates an indirect effect of events on concept nodes using the equations: 

Ip,(Ei,CO = min(g (E|,Cj)) = min(g (E, E^) ® ® Tmn(e^^ (Ek„, Cj)) 

wherein the indirect effect of events Ej on concept nodes Ci can be defined as the 
intersection of the Unk causal types and can be described by the above equation, is a 

function which takes ly to [0,1] in path ^p' i.e. eiij = f ^ (lij, ^lij ), ^ly € {0,1}, and 0 represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
*and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 



^,(///^),///^)) = max{0,;/^(x) + //^(x)-l} 
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wherein ti() is a t-norm betv^een fuzzy sets A and B with membership functions fiA and 

Mb. 



60. (Original) The event-correlation system of claim 59, wherein the analyzer maps the 
received real-time events to the formed FCM fragments by correlating the received events to the 
identified concept nodes to evaluate the effect of the received event nodes on the identified 
concept nodes using the determined element interdependencies. 

61. (Original) The event-correlation system of claim 59, wherein the analyzer correlates the 
received events by accumulating evidence based on the received event nodes and compares the 
accumulated evidence to a threshold value, and analyzes the concept nodes based on the outcome 
of the comparing to evaluate the effect of the received event nodes. 

62. (Original) The event-correlation system of claim 43, further comprising: 

an interface output module coupled to the event-analyzer to output one or more solutions 
based on the outcome of diagnosing the problems by the analyzer. 

63. (Original) The event-correlation system of claim 62, further comprising: 

a memory to store the static and dynamic information. 



